B2B SaaS platform due diligence in Canada

Diligence on a subscription software company is a set of reconciliations. The code is matched to the people who wrote it, the revenue to the contracts that produce it, the data handling to the promises made about it, and the dependencies to the agreements that allow them to move. A buyer under a letter of intent may have a limited window, and each reconciliation begins with a specific document request and ends in a finding that is closed, priced or made a condition of closing. This guide follows that order and says what each finding means when it appears. It is written for someone verifying a platform that sells to other businesses in Canada, and it describes checks, not outcomes.

Match the repository to the signed paper

One step particular to software diligence is comparing everyone who has committed code, as recorded in the version-control history, with the list of signed employment and contractor agreements. Under the Copyright Act an employer is first owner of a work made by an author employed under a contract of service or apprenticeship, in the course of that employment, unless there is an agreement to the contrary, while an assignment of copyright is valid only if it is in writing and signed by the owner or the owner’s duly authorized agent. Moral rights may not be assigned but may be waived in whole or in part, so a contributor’s agreement can include a waiver. An author in the history with no paper means the company may not own that part of the product. Possible cures are a confirmatory assignment signed before closing, a specific indemnity or holdback, or a change to the price. The answers on who owns code written by a contractor and on intellectual property due diligence go further.

Rebuild revenue from the contracts up

Revenue diligence can start from the signed order forms rather than the dashboard. A buyer can ask for an export from the billing system, match each paying customer to a contract, and check term, renewal mechanics, pricing and termination rights. Differences between what is billed and what was signed can show up as side letters, unrecorded discounts, or customers who stopped paying but were never removed. Notices of non-renewal that have been given but are not yet effective mean current revenue overstates the future. Each contract is also read for assignment and change-of-control wording, because a refusal to consent at a major account is among the findings that can end a deal, and for what the platform promises about service levels and liability.

Test the privacy and security record

The Office of the Privacy Commissioner’s guidance says organizations subject to the federal privacy law must report breaches of security safeguards that pose a real risk of significant harm, notify affected individuals, and keep records of all breaches whether or not they present that risk. The OPC can ask to see those records, and knowingly contravening the reporting, notification and record-keeping requirements is an offence. A buyer can therefore ask for the breach record itself, and a company handling large volumes of personal information that reports no incident of any kind can raise a question rather than offering comfort. Where Quebec users are involved, diligence adds checks drawn from the Commission d’accès à l’information’s description of Law 25: whether the business publishes the title and contact details of the person responsible for personal information, how confidentiality incidents are handled, and whether privacy impact assessments were done before information left Quebec.

Search the registries and the accounts

Registry work confirms what the seller says about encumbrances and ownership. A personal property registry search shows whether a lender has registered a security interest over the seller’s assets; Ontario’s registration system, reached through Access Now, lets a user search for liens, and other provinces run their own registries. The Canadian Intellectual Property Office registers copyright assignments and records other documents relating to a copyright, such as security agreements, and its trademarks guide says owners should formally tell the Registrar about changes in ownership, so a search of its records can show who is recorded as owner, though the record can lag the facts where an owner has not done so. Beyond the registries, a buyer can confirm that domain names, app-store listings and cloud accounts are held by the company and not by a founder or contractor personally, and can ask whether any customer holds a source code escrow arrangement whose release terms could be triggered by a sale.

Ask what the vendors and platforms allow

A subscription product rests on outside services: hosting, payment processing, email delivery, identity and analytics tools, and sometimes a marketplace through which customers arrive. Whether each agreement lets the platform move to a new owner is a matter of its own terms, so the vendor list can get the same assignment review as the customer contracts. Diligence can also record where customer data is hosted and which subprocessors touch it, because those facts feed the privacy findings above. The SR&ED file is reviewed in the same pass: the filed claims, the technical descriptions behind them and any correspondence about a review, since the CRA’s guidance covers what to do if a claim needs a review.

Findings that end deals, and what they mean

• An unmatched author whose rights cannot be obtained: the company cannot show it owns part of what is being sold, and the options include rewriting that part, changing the price or stepping away.
• A key customer refusing consent to the transfer of its contract: the revenue attached to that account sits outside the deal unless the customer is persuaded, so a buyer may make that consent a condition of closing.
• An undisclosed breach, or an empty breach record in a data-heavy business: it can raise doubt about everything else the seller has said about security.
• Revenue that does not reconcile: where billing records, signed contracts and bank deposits tell different stories, a buyer can work from the lowest figure until the rest is explained.
• SR&ED claims that are thinly documented: a buyer may decline to count a claim that might not survive review as dependable earnings.